Feature: authenticate as a GitHub App

SPEC lists GitHub App auth as phase 2. Today Ion runs on a maintainer's personal token (gh CLI), which means:

• Ion's own actions are recorded under that maintainer's login, so label and timeline events from Ion and from the maintainer cannot be told apart by actor. mirror_label works around this with timeline snapshots (see PR Mechanical fixes from audit: quorum, push guards, sync, config, policy, collect, fleet #2).
• Rate limits are shared with the maintainer's own use.
• Token scope is whatever the maintainer's token has, rather than the minimum Ion needs.

Proposal: a GH backend that mints installation tokens from an App private key (ghclient.py), with the actor login of Ion's own events known and used in approve/labels.py to filter by actor instead of by timeline diff.

Automated posting by agentic team with human oversight.

Implementation draft awaiting independent code review: #97